njrat | 22994b2261d7e851789cb07ce7b2abd5e59914e73e9169549e664a2f0a1fb315 | Triage

Sharing

General

Target

22994b2261d7e851789cb07ce7b2abd5e59914e73e9169549e664a2f0a1fb315
Size

257KB
Sample

221125-ef76qaaa86
MD5

b4ef176b271e24a121147459b235b2ec
SHA1

9430e1cb765cd3eda840dfb0dc80329b70fe650d
SHA256

22994b2261d7e851789cb07ce7b2abd5e59914e73e9169549e664a2f0a1fb315
SHA512

b2aabeb64caacbf462c18881da2d3ba5d4b30e14676d78561832fb6dfafdac10ecb779fc81026b01bc6f38e2e0bbdb3a826da14ad080237c114c6311c58335d5
SSDEEP

3072:2QSjD9kwi5SRKAL5a/wFHSjjjjjjjjjjjjjjj0KCBB9Ovvsshd7Vcu:DaD9yAL5lFH+mLOvvss+

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  22994b2261d7e851789cb07ce7b2abd5e59914e73e9169549e664a2f0a1fb315
- Size
  
  257KB
- MD5
  
  b4ef176b271e24a121147459b235b2ec
- SHA1
  
  9430e1cb765cd3eda840dfb0dc80329b70fe650d
- SHA256
  
  22994b2261d7e851789cb07ce7b2abd5e59914e73e9169549e664a2f0a1fb315
- SHA512
  
  b2aabeb64caacbf462c18881da2d3ba5d4b30e14676d78561832fb6dfafdac10ecb779fc81026b01bc6f38e2e0bbdb3a826da14ad080237c114c6311c58335d5
- SSDEEP
  
  3072:2QSjD9kwi5SRKAL5a/wFHSjjjjjjjjjjjjjjj0KCBB9Ovvsshd7Vcu:DaD9yAL5lFH+mLOvvss+
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan